cbcvebase.
CVE-2019-25213
published 2024-10-16

CVE-2019-25213: The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to…

PriorityP179high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.71%
84.1th percentile
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php

Affected

2 ranges
VendorProductVersion rangeFixed in
vasyltechadvanced_access_manager<= 5.9.8.1—
vasyltechadvanced_access_manager_access_governance_for_wordpress< 5.9.95.9.9

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php?action=aam-media-load&aam-media=/wp-config.php↗
path/wp-admin/admin-ajax.php↗
otheraction=aam-media-load↗
  • →Detect exploitation attempts by monitoring GET requests to /wp-admin/admin-ajax.php with the 'action=aam-media-load' parameter and an 'aam-media' parameter containing file path values (e.g., /wp-config.php). ↗
  • →A successful exploitation response (HTTP 200) will contain all three strings 'DB_NAME', 'DB_USER', and 'DB_PASSWORD' in the response body, indicating wp-config.php was read. ↗
  • →Identify vulnerable WordPress installations by searching for the plugin path 'wp-content/plugins/advanced-access-manager' in page source. ↗
  • ·The vulnerability affects Advanced Access Manager plugin versions up to and including 5.9.8.1. Versions beyond this are not affected. ↗
  • ·The attack is entirely unauthenticated — no WordPress credentials or session are required to exploit this vulnerability. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.